General

  • Target

    Lenovo联想驱动管理.exe

  • Size

    5.4MB

  • MD5

    19892ca502475811542ddfb7a8330f77

  • SHA1

    9337e76a2e51bd8443f48c770d5b5e780a4a9f33

  • SHA256

    a3e545c2ae35257b15c8afd18e2c3ff40bf32f57f9cdb8bcb39181de383ccb9f

  • SHA512

    6e983f4932df747ea587cda4040f1cb2e13bd99b34e905ef178282eae693ce6314003577253ed345b37b6bf2abe9fb8bdb0f72d88565d54de238d0feff30db2b

  • SSDEEP

    98304:jfKegKDRd8nPCClTFxim2G0AFGRJcPVmSlrgF6zILdUN+LKmYyU04HeL8WXGcTce:DKSY6ClGxw2JIZlMF6ULONMtuHeowGG3

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 4 IoCs

Files

  • Lenovo联想驱动管理.exe
    .exe windows:4 windows x86 arch:x86

    b1a57b635b23ffd553b3fd1e0960b2bd


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecCmd.dll
    .dll windows:4 windows x86 arch:x86

    bf44c9fb48bb8c36b3e2527e7252350d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/OnTop.dll
    .dll windows:4 windows x86 arch:x86

    5868b2e27b7dc96acf77699398b4c95b


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/SkinH.dll
    .dll windows:4 windows x86 arch:x86


    Headers

    Exports

    Sections

  • out.upx
    .dll windows:4 windows x86 arch:x86


    Headers

    Sections

  • $PLUGINSDIR/SkinH.she
  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    f2ac1ab587d5531d5f1bf76c094aef4c


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/finish.bmp
  • $PLUGINSDIR/instpr.bmp
  • $PLUGINSDIR/nsDialogs.dll
    .dll windows:4 windows x86 arch:x86

    f03b2bab186574d8892d3d73fa9fd3fd


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/w7tbp.dll
    .dll windows:4 windows x86 arch:x86

    fdb9d529772752ac356e92b3e3221b71


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/wel.bmp
  • 7z.dll
    .dll windows:4 windows x86 arch:x86

    37deedb4784101f901de7ee8fdfb81d7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • 7z.exe
    .exe windows:4 windows x86 arch:x86

    a01d0c00ae4ce56b6886f26ab65d8fd9


    Code Sign

    Headers

    Imports

    Sections

  • cache.db
  • data/freelotterydrawpao.zip
    .zip
  • bg.png
    .png
    • http://weixin.qq.com/q/02N3PvhpIMaje10000M03L

  • close.png
    .png
  • index.htm
    .html
  • psize.ini
  • data/rcmsoft.dat
  • data/softicon.dat
    .zip
  • icon/1.png
    .png
  • icon/10.png
    .png
  • icon/11.png
    .png
  • icon/12.png
    .png
  • icon/12_bak2.png
    .png
  • icon/12_bak3.png
    .png
  • icon/13.png
    .png
  • icon/14.png
    .png
  • icon/15.png
    .png
  • icon/16.png
    .png
  • icon/17.png
    .png
  • icon/18.png
    .png
  • icon/19.png
    .png
  • icon/2.png
    .png
  • icon/20.png
    .png
  • icon/21.png
    .png
  • icon/22.png
    .png
  • icon/23.png
    .png
  • icon/24.png
    .png
  • icon/25.png
    .png
  • icon/26.png
    .png
  • icon/27.png
    .png
  • icon/28.png
    .png
  • icon/29.png
    .png
  • icon/3.png
    .png
  • icon/30.png
    .jpg
  • icon/31.png
    .png
  • icon/33.png
    .png
  • icon/34.png
    .png
  • icon/35.png
    .png
  • icon/36.png
    .png
  • icon/37.png
    .png
  • icon/38.png
    .png
  • icon/39.png
    .png
  • icon/4.png
    .png
  • icon/40.png
    .png
  • icon/41.png
    .png
  • icon/42.png
    .png
  • icon/43.png
    .png
  • icon/44.png
    .png
  • icon/45.png
    .png
  • icon/47.png
    .png
  • icon/48.png
    .png
  • icon/49.png
    .png
  • icon/5.png
    .png
  • icon/50.png
    .png
  • icon/51.png
    .png
  • icon/52.png
    .png
  • icon/53.png
    .png
  • icon/55.png
    .jpg
  • icon/56.png
    .png
  • icon/57.png
    .png
  • icon/58.png
    .png
  • icon/59.png
    .png
  • icon/6.png
    .png
  • icon/60.png
    .png
  • icon/61.png
    .png
  • icon/62.png
    .png
  • icon/63.png
    .png
  • icon/64.png
    .png
  • icon/65.png
    .png
  • icon/67.png
    .png
  • icon/68.png
    .png
  • icon/69.png
    .png
  • icon/7.png
    .png
  • icon/71.png
    .png
  • icon/72.png
    .png
  • icon/73.png
    .png
  • icon/75.png
    .png
  • icon/8.png
    .png
  • icon/80.png
    .png
  • icon/81.png
    .png
  • icon/9.png
    .png
  • icon/bg-1.png
    .png
  • icon/bg.png
    .png
  • icon/dn-1.png
    .png
  • icon/dn.png
    .png
  • icon/lt-1.png
    .png
  • icon/lt.png
    .png
  • icon/xt-1.png
    .png
  • icon/xt.png
    .png
  • icon/yx-1.png
    .png
  • icon/yy-1.png
    .png
  • icon/yy.png
    .png
  • dgbase.dll
    .dll windows:4 windows x86 arch:x86

    d8528ae18ef6e28a5aa15fc12ee78d08


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • drvinst32.exe
    .exe windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • out.upx
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • drvinst64.exe
    .exe windows:4 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • out.upx
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • duilib.dll
    .dll windows:4 windows x86 arch:x86

    5a049ed11cdf17dc10ac5316362b683e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • kctrl.dat
  • kfmt.dat
  • kinfoc.dll
    .dll windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Exports

    Sections

  • kszzdl.dll
    .dll windows:4 windows x86 arch:x86

    2265d6912992a3e8e6d054f863b6dd38


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lenovodm.exe
    .exe windows:4 windows x86 arch:x86

    13581a7878c8c2bf9b82e7723997bcb2


    Code Sign

    Headers

    Imports

    Sections

  • lenovodmver.dll
    .dll windows:4 windows x86 arch:x86

    2510e8456e7cf8cfd5e8ca357299026b


    Code Sign

    Headers

    Imports

    Sections

  • lenovodrvsrv.exe
    .exe windows:4 windows x86 arch:x86

    6083b87a428b099413d354a714004260


    Code Sign

    Headers

    Imports

    Sections

  • lenovodrvtray.exe
    .exe windows:4 windows x86 arch:x86

    f59f3574f59f65ed152b69fddd7b5dae


    Code Sign

    Headers

    Imports

    Sections

  • lenovosmgr.exe
    .exe windows:4 windows x86 arch:x86

    4cd530e3ddac28fe5e10cd552e85fadb


    Code Sign

    Headers

    Imports

    Sections

  • lenovosmgrc.dll
    .dll windows:4 windows x86 arch:x86

    d0d63fd7a5a72efd899583f943ee1255


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lenovowty.exe
    .exe windows:4 windows x86 arch:x86

    2505b32d5ce829065169b2e0d35c061c


    Code Sign

    Headers

    Imports

    Sections

  • libcurl.dll
    .dll windows:4 windows x86 arch:x86

    231150ebabfdf4a11c0e400ad27dbbde


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • lmfn.dll
    .dll windows:5 windows x86 arch:x86

    e3582187d92a489bff5268cc8d0c4277


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • microsoft.vc80.crt.manifest
  • msvcp80.dll
    .dll windows:4 windows x86 arch:x86

    6488997e312be12f8300ea7b1c34d497


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr80.dll
    .dll windows:4 windows x86 arch:x86

    7fecbc4a16a5dc85a5394a1df6217680


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • mydriversc.dll
    .dll windows:5 windows x86 arch:x86

    efd51898bac3580dbbb8b8b6ecb205f5


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • sqlite3.dll
    .dll windows:4 windows x86 arch:x86

    f374cefaf6cc24a19345fa2d7aad4b05


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • tinyxml.dll
    .dll windows:4 windows x86 arch:x86

    1aa023fb73eb62282e477c4bc8360084


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • uninst.exe
    .exe windows:4 windows x86 arch:x86

    b1a57b635b23ffd553b3fd1e0960b2bd


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/ExecCmd.dll
    .dll windows:4 windows x86 arch:x86

    bf44c9fb48bb8c36b3e2527e7252350d


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/MessageBox.dll
    .dll windows:4 windows x86 arch:x86

    c3f3267799760b39c4e2763e70fc3909


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsProcess.dll
    .dll windows:4 windows x86 arch:x86

    c9fc7f6df8fedf8f8f1f9f820c072664


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/w7tbp.dll
    .dll windows:4 windows x86 arch:x86

    fdb9d529772752ac356e92b3e3221b71


    Headers

    Imports

    Exports

    Sections

  • unzip.dll
    .dll windows:5 windows x86 arch:x86

    4b14a2cf4535c8bf13fc27d61ece0aaf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • unzip.exe
    .exe windows:5 windows x86 arch:x86

    ecaa330bb334ceba30f92b13a56e17e1


    Code Sign

    Headers

    Imports

    Sections

  • uplive.svr
  • xzzhcid.dll
    .dll windows:5 windows x86 arch:x86

    8e37f8e8753f49ab437144952574ffe6


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zlib1.dll
    .dll windows:4 windows x86 arch:x86

    007c3e6d617b75c529b6eb2742337a72


    Code Sign

    Headers

    Imports

    Exports

    Sections